openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Vulnerabilities API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Vulnerabilities
  description: Device vulnerability tracking operations.
paths:
  /vulnerability/list:
    get:
      operationId: listVulnerabilities
      summary: Palo Alto Networks List Vulnerabilities
      description: Returns a paginated list of known vulnerabilities affecting discovered devices. Vulnerability data is correlated from device profiles, firmware versions, and known CVEs. Includes severity ratings, affected device counts, and remediation guidance.
      tags:
      - Vulnerabilities
      parameters:
      - name: customerid
        in: query
        required: true
        description: Customer tenant identifier.
        schema:
          type: string
        example: '458156'
      - name: offset
        in: query
        description: Pagination offset for results.
        schema:
          type: integer
          default: 0
        example: 0
      - name: pagelength
        in: query
        description: Number of vulnerability records to return per page.
        schema:
          type: integer
          default: 100
          maximum: 1000
        example: 100
      - name: stime
        in: query
        description: Start time filter as a Unix epoch timestamp in seconds.
        schema:
          type: string
        example: example-stime
      - name: etime
        in: query
        description: End time filter as a Unix epoch timestamp in seconds.
        schema:
          type: string
        example: example-etime
      responses:
        '200':
          description: Vulnerability list returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of vulnerabilities matching the query.
                  vulnerabilities:
                    type: array
                    items:
                      $ref: '#/components/schemas/Vulnerability'
              examples:
                ListVulnerabilities200Example:
                  summary: Default listVulnerabilities 200 response
                  x-microcks-default: true
                  value:
                    total: 171
                    vulnerabilities:
                    - id: example-id
                      cve: example-cve
                      vulnerability_name: Production Gateway 97
                      severity: critical
                      cvss_score: 41.94
                      deviceid: '527185'
                      affected_device_count: 436
                      description: Security rule blocked Security monitoring rule applied.
                      remediation: example-remediation
                      first_detected: '2026-01-17T19:27:21Z'
                    - id: example-id
                      cve: example-cve
                      vulnerability_name: Production Gateway 97
                      severity: critical
                      cvss_score: 41.94
                      deviceid: '527185'
                      affected_device_count: 436
                      description: Security rule blocked Security monitoring rule applied.
                      remediation: example-remediation
                      first_detected: '2026-01-17T19:27:21Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /vulnerability/detail:
    get:
      operationId: getVulnerabilityDetail
      summary: Palo Alto Networks Get Vulnerability Details
      description: Returns detailed information about a specific vulnerability affecting a device. Includes full CVE information, affected device context, severity scoring, and remediation guidance.
      tags:
      - Vulnerabilities
      parameters:
      - name: customerid
        in: query
        required: true
        description: Customer tenant identifier.
        schema:
          type: string
        example: '958434'
      - name: deviceid
        in: query
        required: true
        description: Unique device identifier.
        schema:
          type: string
        example: '543948'
      - name: vulnerability_name
        in: query
        required: true
        description: Name of the vulnerability to retrieve details for.
        schema:
          type: string
        example: Branch Sensor 56
      responses:
        '200':
          description: Vulnerability details returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  vulnerability:
                    $ref: '#/components/schemas/Vulnerability'
              examples:
                GetVulnerabilityDetail200Example:
                  summary: Default getVulnerabilityDetail 200 response
                  x-microcks-default: true
                  value:
                    vulnerability:
                      id: example-id
                      cve: example-cve
                      vulnerability_name: Production Gateway 97
                      severity: critical
                      cvss_score: 41.94
                      deviceid: '527185'
                      affected_device_count: 436
                      description: Security rule blocked Security monitoring rule applied.
                      remediation: example-remediation
                      first_detected: '2026-01-17T19:27:21Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    Vulnerability:
      type: object
      properties:
        id:
          type: string
          description: Unique vulnerability record identifier.
          example: example-id
        cve:
          type: string
          description: CVE identifier (e.g., CVE-2023-12345).
          example: example-cve
        vulnerability_name:
          type: string
          description: Vulnerability name.
          example: Production Gateway 97
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          - info
          description: Vulnerability severity rating.
          example: critical
        cvss_score:
          type: number
          format: float
          description: CVSS v3 base score.
          example: 41.94
        deviceid:
          type: string
          description: Device identifier affected by the vulnerability.
          example: '527185'
        affected_device_count:
          type: integer
          description: Number of devices affected by this vulnerability.
          example: 436
        description:
          type: string
          description: Vulnerability description.
          example: Security rule blocked Security monitoring rule applied.
        remediation:
          type: string
          description: Recommended remediation steps.
          example: example-remediation
        first_detected:
          type: string
          format: date-time
          description: Timestamp when the vulnerability was first detected.
          example: '2026-01-17T19:27:21Z'
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code or type.
          example: example-error
        message:
          type: string
          description: Human-readable error message.
          example: Monitoring traffic activity network investigation investigation network policy traffic violation rule rule.
  responses:
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or missing API keys.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.